fsylvain/RenewCMS
1
1 Fork 0
Code Issues Pull Requests Packages Projects Releases 31 Wiki Activity

refac: debt on role backend

Browse Source
This commit is contained in:
Florian Sylvain committed 2026-10-26 23:34:35 +01:00
1 parent de142f6c5f
commit a043f7f41a
130 files changed
+3591 -512
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/role_hardening_test.go
+15 -16
View File
@@ -197,19 +197,19 @@ func TestValidateGrants(t *testing.T) {
})
}
func TestRoleAllowsKindAndOwnerOnly(t *testing.T) {
func TestRoleGrantSetKindAndOwnerOnly(t *testing.T) {
t.Run("A toggle grant at scope own does not count", func(t *testing.T) {
if roleWithGrant("schema.view", role.ScopeOwn).Allows("schema.view", true) {
if roleWithGrant("schema.view", role.ScopeOwn).GrantSet().Holds("schema.view") {
t.Errorf("expected false")
}
})
t.Run("Owner-only grants are ignored on a role that is not locked", func(t *testing.T) {
if roleWithGrant("system.apply_updates", role.ScopeAll).Allows("system.apply_updates", true) {
if roleWithGrant("system.apply_updates", role.ScopeAll).GrantSet().Holds("system.apply_updates") {
t.Errorf("expected false")
}
})
t.Run("Owner-only grants count on the locked Owner", func(t *testing.T) {
if !role.BuiltInRoles()[0].Allows("system.apply_updates", false) {
if !role.BuiltInRoles()[0].GrantSet().Holds("system.apply_updates") {
t.Errorf("expected true")
}
})
@@ -247,34 +247,33 @@ func TestParseTypedKey(t *testing.T) {
})
}
func TestRoleAllowsFor(t *testing.T) {
func TestGrantSetTypedDecisions(t *testing.T) {
t.Run("A per-type override denies despite the wildcard", func(t *testing.T) {
r := role.Role{Grants: []role.Grant{{Key: "content.update", Scope: role.ScopeAll}, {Key: "content.update:blog", Scope: role.ScopeOwn}}}
if r.AllowsFor("content.update", "blog", false) {
set := unlockedGrantSet("content.update=all", "content.update:blog=own")
if set.Permits("content.update", "blog", 1, 2) {
t.Errorf("override should deny a non-owned entry")
}
if !r.AllowsFor("content.update", "blog", true) {
if !set.Permits("content.update", "blog", 1, 1) {
t.Errorf("override should allow an owned entry")
}
if !r.AllowsFor("content.update", "news", false) {
if !set.Permits("content.update", "news", 1, 2) {
t.Errorf("other types fall back to the wildcard")
}
})
t.Run("A per-type override grants without a wildcard", func(t *testing.T) {
r := role.Role{Grants: []role.Grant{{Key: "content.read:blog", Scope: role.ScopeAll}}}
if !r.AllowsFor("content.read", "blog", false) || r.AllowsFor("content.read", "news", false) {
set := unlockedGrantSet("content.read:blog=all")
if !set.Permits("content.read", "blog", 1, 2) || set.Permits("content.read", "news", 1, 2) {
t.Errorf("override should apply to blog only")
}
})
t.Run("An empty type key behaves like Allows", func(t *testing.T) {
r := roleWithGrant("content.read", role.ScopeAll)
if !r.AllowsFor("content.read", "", false) {
t.Run("An empty type key reads the wildcard", func(t *testing.T) {
if !roleWithGrant("content.read", role.ScopeAll).GrantSet().Permits("content.read", "", 1, 2) {
t.Errorf("expected true")
}
})
t.Run("A malformed type key or non per-type key is denied", func(t *testing.T) {
r := role.BuiltInRoles()[0]
if r.AllowsFor("content.read", "Bad Key", true) || r.AllowsFor("schema.view", "blog", true) {
set := role.BuiltInRoles()[0].GrantSet()
if set.Permits("content.read", "Bad Key", 1, 1) || set.Permits("schema.view", "blog", 1, 1) {
t.Errorf("expected false")
}
})